The internal analyzer is not detecting vulnerabilities in Dependency Track

### Current Behavior

When I upload an SBOM that contains internal components and third party packages (ex : debian) there are no vulnerabilities that are shown for the created project.
Knowing that i have enabled OSSIndex and I have added the sonatype account.
I did a test with an SBOM that contains python packages and there are vulnerabilities that are detected with the OSSIndex analyzer. So the issue is related to the internal analyzer.

### Steps to Reproduce

1. Upload an SBOM that contains some debian packages that are vulnerables.
2. After the VulnerabilityAnalysis task is done check if the project contains vulnerabilities

### Expected Behavior

The vulnerabilities should be shown for the created project

### Dependency-Track Version

4.7.x

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported